Examining Code Reuse Reveals Newsletter Sign Up Undiscovered Links Among North First Name * Korea’s Malware Families By Jay Rosenberg and Christiaan Beek on Aug 09, 2018 Last Name * This research is a joint effort by Jay Rosenberg, senior security researcher at Intezer, and PDFmyURL - online url to pdf conversion Christiaan Beek, lead scientist and senior principal engineer at McAfee. Intezer has also posted Email Address * this story. Attacks from the online groups Lazarus, Silent Chollima, Group 123, Hidden Cobra, Country * DarkSeoul, Blockbuster, Operation Troy, and 10 Days of Rain are believed to have come --Please Select-- from North Korea. But how can we know with certainty? And what connection does a DDoS and disk-wiping attack from July 4, 2009, have with WannaCry, one of the largest Submit cyberattacks in the history of the cyber sphere? From the Mydoom variant Brambul to the more recent Fallchill, WannaCry, and the targeting of cryptocurrency exchanges, we see a distinct timeline of attacks beginning McAfee on Twitter from the moment North Korea entered the world stage as a significant threat actor. Follow us on Twitter Bad actors have a tendency to unwittingly leave fingerprints on their attacks, allowing researchers to connect the dots between them. North Korean actors have left many of these clues in their wake and throughout the evolution of their malware arsenal. mcafee_labs Threat actors continue to evolve This post reflects months of research; in it we will highlight our code analysis illustrating their tools, increasing complexity key similarities between samples attributed to the Democratic People’s Republic of and functionality. Learn how Korea, a shared networking infrastructure, and other revealing data hidden within the these cybercrimes… binaries. Together these puzzle pieces show the connections between the many attacks https://t.co/ibrUsYyn7V attributed to North Korea and categorize different tools used by specific teams of their cyber army. 21 hours ago Reply · Retweet · Favorite Valuable context This article is too short to dig deeply into the history, politics, and economic changes of mcafee_labs recent years. Nonetheless, we must highlight some events to put past and present cyber events into perspective. ICYMI: Our team analyzed Operation GhostSecret, a Hidden PDFmyURL - online url to pdf conversion The DPRK, like any country, wants to be as self-sufficient and independent as possible. Cobra campaign that leveraged However, for products such as oil, food, and foreign currency for trading, the country multiple #malware implants i… lacks resources and has to find ways of acquiring them. What can a nation do when legal https://t.co/FLgQ6Vn4yc international economics are denied? To survive, it must gain foreign currency for trading. 22 hours ago One of the oldest ways to do this is to join the worlds of gambling (casinos) and drugs. In Reply · Retweet · Favorite 2005, the United States wanted to shut down North Korean enterprises involved in illegal operations. They investigated a couple of banks in Asia that seemed to have ties with North Korea and operated as money laundering sites. One bank in particular is mcafee_labs controlled by a billionaire gambling mogul who started a casino in Pyongyang and has close ties to Pyongyang. That bank, based in Macau, came back into the picture during an Bad actors are exploiting attack on the SWIFT financial system of a bank in Vietnam in 2015. The Macau bank was connected home devices to find listed twice in the malware’s code as a recipient of stolen funds: new innocent targets. Which connected device do you think… https://t.co/pxWq9B6Rqo 2 days ago Reply · Retweet · Favorite Next Article PDFmyURL - online url to pdf conversion Consumer Threat Notices 5 Tips To Protect Your IoT Devices Figure 1: SWIFT code in malware. Code reuse PDFmyURL - online url to pdf conversion There are many reasons to reuse malware code, which is very common in the world of cybercrime. If we take an average ransomware campaign, for example, once the campaign becomes less successful, actors often change some of basics such as using a different packer to bypass defenses. With targeted campaigns, an adversary must keep its tools undetected for as long as possible. By identifying reused code, we gain valuable insights about the “ancestral relations” to known threat actors or other campaigns. Our research was heavily focused on this type of analysis. In our years of investigating cyber threats, we have seen the DPRK conduct multiple cyber campaigns. In North Korea, hackers’ skills determine which cyber units they work for. We are aware two major focuses of DPRK campaigns: one to raise money, and one to pursue nationalist aims. The first workforce gathers money for the nation, even if that means committing cybercrime to hack into financial institutions, hijack gambling sessions, or sell pirated and cracked software. Unit 180 is responsible for illegally gaining foreign currency using hacking techniques. The second workforce operates larger campaigns motivated by nationalism, gathering intelligence from other nations, and in some cases disrupting rival states and military targets. Most of these actions are executed by Unit 121. We focused in our research on the larger-scale nationalism-motivated campaigns, in which we discovered many overlaps in code reuse. We are highly confident that nation- state–sponsored groups were active in these efforts. Timeline We created a timeline of most of the malware samples and noticeable campaigns that we examined. We used primarily open-source blogs and papers to build this timeline and used the malware artifacts as a starting point of our research. PDFmyURL - online url to pdf conversion Figure 2: Timeline of malware and campaigns. Analysis and observations Similarities During our research, we found many malware family names that are believed to be associated with North Korea’s cyber operations. To better understand this threat actor and the similarities between the campaigns, we have used Intezer’s code similarity detection engine to plot the links between a vast number of these malware families. The following graph presents a high-level overview of these relations. Each node PDFmyURL - online url to pdf conversion represents a malware family or a hacking tool (“Brambul,” “Fallchill,” etc.) and each line presents a code similarity between two families. A thicker line correlates to a stronger similarity. In defining similarities, we take into account only unique code connections, and disregard common code or libraries. This definition holds both for this graph and our entire research. PDFmyURL - online url to pdf conversion Figure 3: Code similarities between North Korean–associated malware families. PDFmyURL - online url to pdf conversion We can easily see a significant amount of code similarities between almost every one of the attacks associated with North Korea. Our research included thousands of samples, mostly unclassified or uncategorized. This graph was plotted using a data set of only several hundred samples, so there might be more connections than displayed here. Deep technical analysis During our research, we came across many code similarities between North Korean binaries that had not been seen before. Some of these attacks and malware have not been linked to one another, at least publicly. We will showcase four examples of reused code that has been seen only in malware attributed to North Korea. 1. Common SMB module The first code example appeared in the server message block (SMB) module of WannaCry in 2017, Mydoom in 2009, Joanap, and DeltaAlfa. Further shared code across these families is an AES library from CodeProject. These attacks have been attributed to Lazarus; that means the group has reused code from at least 2009 to 2017. PDFmyURL - online url to pdf conversion Figure 4: Code overlap of a Mydoom sample. In the next screenshots we highlight the exact code block that reflects the SMB module we found in campaigns other than WannaCry and Mydoom. PDFmyURL - online url to pdf conversion PDFmyURL - online url to pdf conversion Figure 5: An SMB module common to several attacks. A lot has been written about WannaCry. As we analyze the code against our databases, we can draw the following overview: PDFmyURL - online url to pdf conversion Figure 6: WannaCry code comparison overview. For our research we compared the three major variants of WannaCry. An early release, called a beta, from February 2017, one from April, and the infamous one that hit the world in May. 2. Common file mapping The second example demonstrates code responsible for mapping a file and using the XOR key 0xDEADBEEF on the first four bytes of the file. This code has appeared in the PDFmyURL - online url to pdf conversion malware families NavRAT and Gold Dragon, plus a certain DLL from the South Korean gambling hacking campaign. These three RATs are thought to be affiliated with North Korea’s Group 123. NavRAT and the gambling DLL share more code, making them closer variants. Figure 7: Code overlap in a NavRAT sample. PDFmyURL - online url to pdf conversion PDFmyURL - online url to pdf conversion Figure 8: File-mapping code 3. Unique net share The third example, responsible for launching a cmd.exe with a net share, has been seen in 2009’s Brambul, also known as SierraBravo, as well as KorDllBot in 2011. These malware families are also attributed to the Lazarus group. Figure 9: Code overlap of a SierraBravo (Brambul) sample. PDFmyURL - online url to pdf conversion PDFmyURL - online url to pdf conversion Figure 10: A code block reused in the malware families Brambul/SierraBravo and KorDllBot. 4. Operation Dark Hotel In 2014, Kaspersky reported a more than seven-year campaign against Asian hotels, in which the adversaries used an arsenal of tools to break into the computers of hotel visitors. Zero days and control servers were used, along with the malware family Tapaoux, or DarkHotel, according to the report.